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SENSOR, CONTROL UNIT, AND METHOD FOR MONITORING AT LEAST 

ONE SENSOR 



Field of the Invention 

The invention generally relates to a sensor and a control unit 
and a method" for monitoring at least one sensor. 

Summary of the Invention 

The sensor according to the present invention and control unit 
according to the present invention and method for monitoring 
at least one sensor according to the present invention having 
the features of the independent claims have the advantage that 
a differentiated fault pattern can be transmitted with a 
specific fault message to the system i.e. to the control 
unit -- and an appropriate reaction can occur, while 
preventing every fault in a sensor from having the consequence 
that the sensor signal as a whole must not be used, or that 
the system identifies a permanent sensor fault and therefore a 
system defect. Disruptions that do not denote lasting sensor 
damage, and possibly are even attributable to infrequent but 
possible operating states, can therefore be not too severely 
punished. Examples of this are the incoupling of 
electromagnetic interference, and vibrations due to hammer 
blows. The performance or sensitivity of the system is thereby 
improved, and the probability of a control unit field failure 
is reduced. The invention in particular makes it possible, 
with adaptation and application to the respective target 
control unit and vehicle, to react better to specific 
differing system requirements and customer requirements in 
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terms of triggering parameters and fault management. 

This allows on the one hand an increase in the performance and 
robustness of the overall system, and on the other hand a 
5 reduction in field failure fates, since with the more in-depth 
fault pattern detection not all fault patterns must be deemed 
total failures. The invention is additionally advantageous 
because fault discovery and optimization can be facilitated in 
the development and testing phase of a restraint system. 
10 Application of the invention is also possible and advisable, 
however, in other automotive sectors in which sensors are 
used, in particular in vehicle dynamics control and in 
navigation. 

15 It is particularly advantageous that the status bits 

indicating the fault modes are constituted from different 
sensor- internal monitoring mechanisms, and remain in existence 
only until a conclusion is drawn as to the operating state 
belonging to the fault state. The time information for each 

2 0 individual fault mode is thus also usable for system- side 

application of the sensor. This permits an accurate analysis 
of the fault, achievable using a so-called look-up table. The 
fault pattern transmitted from the sensor to the control unit 
can then be evaluated accordingly in the processor of the 

25 control unit. It is thereby possible, in particular, for the 
control unit to detect whether the fault is permanent and how 
serious the fault is. 

It is especially advantageous that the fault pattern is 
30 transmitted digitally in an eight-bit word, here given the 

abbreviation MONI , in a 16-bit frame. The MONI word can have 
different fault indications written to it using different read 
instructions. The number of transmittable fault modes can 
thereby be increased. In this word, the fault type or modes 
35 are identified by flags. A variety of fault modes and unusual 
operating states that have been detected are thus indicated by 
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way of this word. Fault modes indicate that at least one 
sensor operating parameter is outside a predefined range. 

In the context of this monitoring, advantageously at least one 
5 phase- lock loop of the sensor and/or at least one control 

voltage is monitored in terms of a predefined range, and/or 
the output values of at least one analog/digital converter are 
monitored in terms of a predefined range, and/or the input 
and/or output values of at least one digital /analog converter 

10 are monitored in terms of a predefined range, and/or the 

dynamic limits of at least one capacitance/voltage converter 
are monitored in terms of a predefined range, and/or at least 
one offset controller is monitored in terms of a predefined 
range, and/or at least one common-mode controller is monitored 

15 in terms of departure from a predefined range, and/or at least 
one variable representing a sensor oscillation is monitored in 
terms of a predefined range, and/or impermissible values of at 
least one counter are monitored as defined. When a fault or an 
unusual operating state is detected, a respective value is set 

2 0 in a respective register, i.e. a fault register is occupied by 

a logical "1" . When that fault or unusual operating state is 
no longer detected, the respective register is then reset, 
i.e. a logical "0" is once again set. 

25 When at least one value that denotes a fault is set to " 1", 
another value is also set to one. This makes it possible to 
indicate, by way of a single bit or flag, whether any 
sensor- internal fault has been identified. This flag is 
transmitted as status information along with every regular 

3 0 sensor output value transmission. If necessary, i.e. in the 

event the summarizing value indicates a fault state, the 
detailed fault pattern can then be requested by way of the 
available read instructions. This procedure of requesting as 
necessary saves transmission and processing capacity. The 
35 allocation of read instructions numbered 1, 2, etc. to the 
fault information is defined in the MONI word. Two read 
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instructions are used here, i.e. two eight-bit words of fault 
inf ormation can be indicated. 

It is additionally advantageous that the sensor itself is 
5 disposed inside the housing of the control unit. SPI (serial 
peripheral interface) lines are then preferably used to 
interconnect the sensor (via the digital interface) and the 
processor of the control unit. 

10 Brief Description of the Drawings 

The present invention will be described in greater detail with 
reference to the following drawings wherein: 

15 Figure 1 shows a block diagram of the sensor according to the 
present invention in a control unit according to the present 
invention. 

Figure 2 shows a data telegram according to the present 
2 0 invention. 

Detailed Description of the Invention 

Rotation rate sensors, like other sensors as well, are being 

2 5 used more and more in electronic restraint systems for passive 

vehicle safety. Rotation rate sensors are core components for 
the detection of rollover processes and related accident 
processes, for example soil trip. 

3 0 Some of the sensors used in restraint systems possess a 

sensor- internal monitoring function. A fault or malfunction 
state resulting from a wide variety of causes can, when it is 
identified, be reported by way of a logical signal (fault, no 
fault) , in a context of analog sensor interfaces, to the 
35 system, to a sensor platform, to a control unit that is 

generally a microcontroller, or to a safety semiconductor. 
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Digital sensors offer the^capability , relatively easily 
implemented in technical terms, of transmitting various faults 
and malfunction states to the system by way of permanently 
assigned bits in data words. Each bit has associated with it a 
5 fault flag, which in turn is associated with a sensor- internal 
circuit block or a sensor- internal monitoring variable or 
measured variable. The sensor- internal monitoring function 
generally responds when one of the various sensor- internal 
control voltages or control variables being monitored enters 

10 the limits of its respective dynamic range or is beyond 

design-related value ranges, or when offset values are outside 
permissible ranges, or when a phase-lock loop drops out of 
synchronization, or when counters are found to have an 
overflow or impermissible values. Monitoring is generally 

15 performed by way of window comparators or by evaluating the 
analog/digital converter output or the digital/analog 
converter input word. There are thus a wide variety of causes 
in terms of the sensor evaluation circuit function blocks. 

20 Possible causes of malfunction or fault states: 

In rotation rate sensors used in automotive systems, 
vibrational or mechanical disturbance sensitivity is a matter 
of functional principle and is a characteristic property that 

25 must be accounted for in the sensor application. If there is 
no mechanical damping, the performance of these systems is 
limited. A mechanical damper assemblage means a considerable 
additional outlay in terms of development, cost, and 
production. Impacts or severe vibrations can disrupt the 

3 0 sensor element so much that the sensor- internal control 

systems can no longer engage for a certain period of time, and 
the sensor ends up outside its specified functional range. 
Further possible disturbances are, for example, incoupled 
electromagnetic interference. Faults in the sensor itself or 

35 in the application wiring can likewise impair system 

operation. The effects differ depending on the rotation rate 
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sensor fault and the kind of disturbance, and also depending 
on the application environment of the sensor, i.e. the wiring 
and circuit board and the vehicle construction. 

5 The rotation rate sensor monitoring function has hitherto been 
used on the system side only for basic fault detection, i.e. 
is the sensor OK or not. As regards its reaction, the 
restraint system at most distinguishes by way of the duration 
of the fault message whether or not a failure of the rotation 
10 rate sensor exists. That absent, an application in terms of 
coordinating the respective system reaction to the various 
fault messages does not take place. 

Since no classification of different fault patterns is 
15 performed on the system side, and the application environment 
also is not incorporated, the principle of "assuming the 
worst" must be invoked. When the monitoring function 
identifies a state as faulty, the consequence is that the 
sensor signal must not be used, or that the system concludes 
20 that a permanent sensor fault and therefore a system defect 

exists. Malfunctions that do not signify lasting sensor damage 
and are possibly attributable to infrequent but possible 
operating states are therefore generally punished too 
severely. This limits the performance or sensitivity of the 
25 systems, or increases the probability of a possibly 
unnecessary control unit field failure. 

According to the present invention, a fault pattern that 
contains the combination of different fault modes is therefore 
3 0 transmitted from the sensor to the system, preferably a 

processor of the control unit, thus conveying to the system 
accurate information about the nature and cause of the fault. 
An appropriate reaction by the system to that fault is then 
therefore possible. 

35 

The fault patterns that occur in response to various fault and 
NY01 722593vl 6 SUBSTITUTE SPECIFICATION 



malfunction causes are already determined in the development 
and application phase of restraint system electronics systems. 
With the availability of a look-up table, the system can react 
properly to the particular fault pattern. 

5 

A practical prerequisite for implementation of the invention 
is a digital sensor interface. Only with this can a large 
number of different faults and malfunction modes or patterns, 
as well as combinations thereof, be transmitted to the system 

10 with reasonable, outlay. The bidirectional SPI (serial 
peripheral interface) is used here as an example of an 
interface. In this context, for example, two instructions 
RD_MONITOR_I and RD_MON I TOR_ 1 1 are provided for reading out 
the various fault modes, the modes themselves being identified 

15 by way of flags in the MONI word transmitted back in each 

case. The word having eight zeroes, for example, means here 
that the monitored sensor parameter is within specified 
operating ranges, and an unusual operating state does not 
exist. The following faults can be indicated by coding: 

20 

The capacitance/voltage converter in which the measured 
variable is mapped by way of the sensor principle into a 
capacitance or a capacitance change is outside its predefined 
range; the value at the analog/digital converter in the drive , 

25 path, which is an oscillating sensor, is outside its 

predefined range; the phase-lock loop is not synchronized; the 
offset controller is outside its predefined range; the sum 
value and/or difference value of the common-mode control 
circuit in the drive circuit and/or in the detection circuit 

3 0 is outside its predefined range; the amplitude of the sensor 

oscillation is outside its predefined range. The drive circuit 
of a rotation rate sensor serves to generate a defined (i.e. 
usually regulated) oscillating or rotational motion with 
which, in the presence of a rotation rate, a measurable effect 

3 5 (for example, a deflection of a micromechanical structure 
orthogonally to that motion) is generated using e.g. the 
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principle of conservation of angular momentum. This effect is 
measured or sensed, and processed, in the detection circuit. 

In addition to these fault indications, an unusual operating 
5 state can be indicated if the rotation rate value that is 

present exceeds or falls below the measurement range of the 
sensor, and the value must be mapped onto the maximum or 
minimum value that can be represented. 

10 Figure 1 shows the sensor and the control unit according to 

the present invention in a block diagram. Located in a control 
unit 10 is a sensor 1 that is connected via a digital line 6 
to a processor 7. Processor 7 is connected via a data 
input/output to a memory 8. Processor 7 is connected via a 

15 data output to the remainder of restraint system 9. A 

so-called safety semiconductor 11, i.e. a further processor or 
a monitoring circuit that also evaluates the sensor output 
values and can influence the enabling of restraint means, can 
be connected to digital line 6. Located in sensor 1 is a 

20. sensor element 2 for acquiring a measured variable, e.g. 

rotation rates or rotational accelerations. The sensor element 
can chiefly be a micromechanical sensor structure in which 
drive and detection occur capacitatively . Sensor element 2 is 
connected to a functional and monitoring module 3 where 

25 capacitance/voltage conversion, analog/digital conversion of 
the sensor signal, driving and regulation of the sensor 
oscillation, and sensor- internal monitoring functions can be 
implemented. Functional and monitoring module 3 is connected 
via a data output to a transmitter module 4 . Transmitter 

30 module 4 is connected to digital line 6, which is embodied 
here as a so-called SPI (serial peripheral interface) line. 

Functional and monitoring module 3 thus also performs 
monitoring functions in sensor 1. The measured values are 
35 conveyed to transmitter module 5 . At a cycling rate predefined 
by the sensor circuit timing cycle, the fault patterns are 
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continuously updated and can be continuously queried. The 
measured values in sensor 1 are incorporated into this fault 
pattern. 

Figure 2 schematically shows a data frame of the requested 
16-bit MISO word, which is subdivided into a first part 12 and 
a second part 11. The respective fault word 11 (MONI) is 
transmitted in second part 11. Two fault words, which can be 
read out using different MOSI instructions, can be transmitted 
here. This can occur cyclically or only when necessary. That 
necessity is indicated in the standard rotation rate , 
transmission by setting a bit that indicates an unusual 
operating state. That bit is set when at least one indicatable 
fault instance is deemed to exist. 

Sensor 1 can also, alternatively, be located outside control 
unit 10. Instead of only one sensor 1, several sensors, 
possibly of different kinds, can also be used and monitored. 
In addition to the restraint system discussed here, other 
vehicle systems are also suitable for this invention, for 
example a vehicle dynamics system or a navigation system. 
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